Section 6(1) in THE DIGITAL PERSONAL DATA PROTECTION ACT, 2023
(1)The consent given by the Data Principal shall be free, specific, informed, unconditional and unambiguous with a clear affirmative action, and shall signify an agreement to the processing of her personal data for the specified purpose and be limited to such personal data as is necessary for such specified purpose.Illustration.X, an individual, downloads Y, a telemedicine app.Y requests the consent of X for (i) the processing of her personal data for making available telemedicine services, and (ii) accessing her mobile phone contact list, and X signifies her consent to both. Since phone contact list is not necessary for making available telemedicine services, her consent shall be limited to the processing of her personal data for making available telemedicine services.(2)Any part of consent referred in sub-section (1) which constitutes an infringement of the provisions of thisAct or the rules made thereunder or any other law for the time being in force shall be invalid to the extent of such infringement.Illustration.X, an individual, buys an insurance policy using the mobile app or website of Y, an insurer. She gives to Y her consent for (i) the processing of her personal data by Y for the purpose of issuing the policy, and (ii) waiving her right to file a complaint to the Data Protection Board of India. Part (ii) of the consent, relating to waiver of her right to file a complaint, shall be invalid.
